The Advanced Custom Fields: Extended WordPress plugin up to version 0.9.2.6 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to delete arbitrary media library attachments by submitting a crafted form with a numeric attachment ID, without verifying user ownership or capabilities. Exploitation requires a site administrator to have configured a public-facing ACFE form with an Email action that includes a deletable attachment field bound to user input.
The Advanced Views – Display Framework for Gutenberg & Elementor WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter in all versions up to and including 3.9.6. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. These scripts execute whenever a user accesses a page containing the injected comment, including pages displaying pending or unapproved comments due to lack of approval-status filtering.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and certain LTS releases contain an improper access control vulnerability (CWE-284). This flaw allows an unauthenticated remote attacker to potentially cause a denial of service. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily due to denial of service. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.
@fastify/express versions 4.0.5 through 4.0.8 contain a vulnerability where, if Fastify is configured with the non-default ignoreDuplicateSlashes option, path-scoped Express middleware may be bypassed. This occurs because Fastify's router normalizes duplicate slashes differently than Express when handling absolute-form request targets, allowing requests to reach scoped routes without passing through authentication or authorization middleware. The issue is fixed in version 4.0.9.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and certain LTS releases contain a stack-based buffer overflow vulnerability (CWE-121). This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. Fixes are available in versions 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later, and 7.13.1.90 or later.
CVE-2026-41021 affects Eaton easyE4 versions prior to 2.46 and involves weak password requirements. This weakness allows an attacker who has obtained password hashes, potentially via another vulnerability (CVE-2026-41020), to perform offline password-guessing attacks and recover user credentials. The vulnerability is rated high severity with a CVSS score of 7.5. Eaton has fixed this issue in version 2.46.
Dell PowerProtect Data Domain versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, and LTS2026 release versions 8.6.1.0 through 8.6.1.20 contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.
@fastify/session versions before 11.1.6 have a race condition vulnerability in the default rolling session behavior. This flaw allows an attacker who possesses a valid signed session cookie to replay that cookie across a logout event, restoring the session after it was intended to be destroyed. The issue arises because a request restoring a session before a logout can overwrite the destroyed session entry, effectively resurrecting the session without cookie theft or signature forgery. The vulnerability is fixed in version 11.1.6 by adding a per-session generation marker and conditional store writes to prevent session restoration or overwriting after logout.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7, including several LTS releases, contain a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). This vulnerability allows an unauthenticated remote attacker to induce the server to make unintended requests. The issue is fixed in versions 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later, and 7.13.1.90 or later.
The npm package '@azure-growth/signup-ux-components' version 1.2.2 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain linked to malicious activity. There is no CVSS score or detailed technical impact provided. No known exploits in the wild have been reported.
CVE-2026-102800 is a high-severity stored cross-site scripting (XSS) vulnerability in the DJ-HelpfulArticles extension for Joomla versions 1.0.0 through 1.2.0. The vulnerability arises from an unauthenticated voting widget that accepts a client-supplied 'ip' field via AJAX without proper output escaping. This field is stored and later rendered in the Joomla administrator backend without HTML escaping, enabling stored XSS attacks. The lack of CSRF tokens and rate limiting exacerbates the risk by allowing repeated exploitation.
CVE-2026-41020 is an authentication bypass vulnerability in Eaton easyE4 devices caused by the use of a static nonce during authentication. This flaw allows an unauthenticated attacker who has captured valid authentication traffic to replay it and gain unauthorized access to the device. The vulnerability affects versions prior to 2.46. A fix is available in version 2.46. The vulnerability has a high severity rating with a CVSS score of 7.5.
CVE-2026-4337 is a high-severity vulnerability in the PuMuKIT application that allows unauthenticated users to upload files of any type to the server. The vulnerability permits uploads to any location where the web server user has write permissions, potentially enabling file deletion as well. This unrestricted file upload flaw can lead to significant security risks including unauthorized file manipulation.
A vulnerability in darylldoyle's svg-sanitizer versions from 0.11.0 up to but not including 1.1.0 allows attackers to cause an uncaught exception by submitting well-formed XML documents lacking a top-level svg root element. This leads to a LogicException being thrown by the Sanitizer::sanitize() function, which can crash processes or bypass upload rejection mechanisms.
A denial of service vulnerability exists in darylldoyle svg-sanitizer versions from 0.5.3 up to but not including 1.1.0. The issue occurs in the Sanitizer::sanitize() function, which repeatedly rescans the entire input while stripping PHP tags. This inefficient algorithmic complexity allows unauthenticated attackers to craft SVG files with many overlapping PHP tag openers and closers, causing excessive CPU usage and service disruption.
CVE-2026-117539 is a cross-site scripting (XSS) vulnerability in darylldoyle svg-sanitizer versions before 1.0.0. The flaw allows attackers to embed external resources by uploading crafted SVG files that contain unsanitized style content, unquoted url() values, or image href attributes. This can lead to exfiltration of page data, user tracking, or disclosure of visitor IP addresses.
REDAXO core versions before 5.21.0 have a reflected cross-site scripting (XSS) vulnerability in the backend packages API. The flaw arises because a function parameter is concatenated into an error message without proper HTML escaping. An attacker can exploit this by tricking an authenticated backend user into clicking a crafted link containing a valid CSRF token, leading to JavaScript execution that can perform same-origin actions or read DOM data. This vulnerability is fixed in version 5.21.0.
REDAXO core versions before 5.21.0 contain a reflected cross-site scripting (XSS) vulnerability. Authenticated attackers can exploit this flaw by injecting malicious scripts via the 'type' parameter in the metainfo_default_fields_create API. The vulnerability arises because rex_view::message() renders attacker-controlled input without proper escaping, allowing script execution in the backend session of a victim. This issue is fixed in REDAXO version 5.21.0.
REDAXO core versions before 5.21.3 have a cross-site request forgery (CSRF) vulnerability in the backend user administration page. The flaw exists because the CSRF token validation only occurs when the 'save' parameter is set, but not during the update path triggered by FUNC_UPDATE. This allows attackers to trick logged-in backend users with user management permissions into executing unauthorized actions such as granting administrator rights, deactivating accounts, or locking out the sole administrator via crafted GET requests.
REDAXO core versions before 5.21.3 have a reflected cross-site scripting (XSS) vulnerability in the backend media pool detail page. The vulnerability arises because the opener_link parameter is rendered without HTML escaping. An unauthenticated attacker can trick logged-in backend users with media permissions into clicking a crafted link, allowing script injection. This injected script can read the victim's CSRF token and perform actions with the victim's permissions, including code execution via template or module edits if the victim is an administrator. The issue is fixed in version 5.21.3.